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AMENDMENTS TO THE CLAIMS: 

This listing of claims will replace all prior versions and listings of claims in the 
application: ■ — 

Claim 1 . (original) An encryption apparatus for converting a plaintext block 
into a ciphertext block depending on supplied key information, comprising: 

means for randomly selecting one pattern of each of pairs ai, ai (where i is a 
positive integer not less than one) of one or a plurality of predetermined mask patterns 
and mask patterns obtained by bit inversion of the predetermined mask patterns every 
time encryption is performed; 

means for masking bits dependent on a plaintext within said apparatus with the 
mask patterns selected by said selection means; and 

means for removing an influence of the mask a from a ciphertext before the 
ciphertext is output. 

Claim 2. (original) An encryption apparatus for converting a plaintext block 
into a ciphertext block depending on supplied key information, comprising: 

means for randomly selecting one pattern of each of pairs ai, ai (where i is a 
positive integer not less than one) of one or a plurality of predetermined mask patterns 
and mask patterns obtained by bit inversion of the predetermined mask patterns every 
time encryption is performed; 

means for masking intermediate bit data within said apparatus with the mask 
patterns selected by said selection means; and 
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means for removing an influence of the mask a from the intermediate bit data 
masked by said masking means. 

Claim 3. (original) An encryption apparatus for converting a plaintext block 
into a ciphertext block depending on supplied key information, comprising: 

data translation means for performing data translation to intermediate data within 
said apparatus; 

means for randomly selecting one pattern of each of pairs ai, ai (where i is a 
positive integer not less than one) of one or a plurality of predetermined mask patterns 
and mask patterns obtained by bit inversion of the predetermined mask patterns every 
time encryption is performed; 

means for masking an input to said data translation means with the mask 
patterns selected by said selection means; and 

means for removing an influence of the mask a from an output from said data 
translation means which is masked by said masking means. 

Claim 4. (original) An apparatus according to claim 1 , wherein said means 
for masking the bits dependent on the plaintext within said apparatus with the selected 
mask patterns and said means for removing the influence of the mask a from the 
ciphertext comprise one of an exclusive OR, addition or subtraction with respect to a 
modulus, and multiplication or division with respect to the modulus. 
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Claim 5. (original) An apparatus according to claim 2, wherein said means 
for masking the intermediate bit data within said apparatus with the selected mask 
patterns and said means for removing the influence of the mask a from the masked 
intermediate bit data comprise one of an exclusive OR, addition or subtraction with 
respect to a modulus, and multiplication or division with respect to the modulus. 

Claim 6. (original) An apparatus according to claim 3, wherein said data 
translation means, said means for masking the input to said data translation means with 
the selected mask patterns, and said means for removing the influence of the mask a 
from the masked output from said data translation means comprise one of an exclusive 
OR, addition or subtraction with respect to a modulus, and multiplication or division with 
respect to the modulus. 

Claim 7. (original) An apparatus according to claim 3, further comprising: 
first storage means for storing, in the form of a table, said means for randomly 

selecting one pattern of each of the pairs ai, ai (where i is a positive integer not less 
than one) of one or the plurality of predetermined mask patterns and the mask patterns 
obtained by bit inversion of the predetermined mask patterns every time encryption is 
performed, said means for masking the input to said data translation means with the 
mask patterns ai, and said means for removing the influence of the masks ai from the 
masked output from said data translation means; 

second storage means for storing, in the form of a table, said means for masking 
the input to said data translation means with mask patterns a , and said means for 
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removing an influence of the masks a from the masked output from said data 
translation means; and 

masked data translation means for randomly selecting one of said first and 
second storage means every time encryption is performed, and performing the 
processing by said data translation means for masked data. 

Claim 8. (original) An apparatus according to claim 1, wherein the pair a, a 
of the mask patterns and the mask patterns obtained by bit inversion comprises a pair 
a, a of predetermined fixed mask patterns and mask patterns obtained by bit inversion 
of the fixed mask patterns. 

Claim 9. (original) An apparatus according to claim 1 , wherein the pair a, a 
of the mask patterns and the mask patterns obtained by bit inversion are not necessarily 
concealed. 

Claim 10. (original) An apparatus according to claim 1 , wherein a Hamming 
weight indicating the number of bits "1s" of an n-bit long bit sequence x is defined as 
H(x), and the Hamming weight H(a) of the mask a satisfies 0 < H(a) < n. 

Claim 11. (original) An apparatus according to claim 1 , wherein a Hamming 
weight indicating the number of bits "1s" of an n-bit long bit sequence x is defined as 
H(x), and an absolute value of a difference between the Hamming weight H(a) of the 
mask a and a Hamming weight H(a) of bit inversion a of the mask a is less than n/2. 
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Claim 12. (original) A decryption apparatus for converting a ciphertext block 
into a plaintext block depending on supplied key information, comprising: 

means for randomly selecting one pattern of each of pairs ai, ai (where i is a 
positive integer not less than one) of one or a plurality of predetermined mask patterns 
and mask patterns obtained by bit inversion of the predetermined mask patterns every 
time decryption is performed; 

means for masking bits dependent on a ciphertext within said apparatus with the 
mask patterns selected by said selection means; and 

means for removing an influence of the mask a from a plaintext before the 
plaintext is output. 

Claim 13. (original) A decryption apparatus for converting a ciphertext block 
into a plaintext block depending on supplied key information, comprising: 

means for randomly selecting one pattern of each of pairs ai, ai (where i is a 
positive integer not less than one) of one or a plurality of predetermined mask patterns 
and mask patterns obtained by bit inversion of the predetermined mask patterns every 
time decryption is performed; 

means for masking intermediate bit data within said apparatus with the mask 
patterns selected by said selection means; and 

means for removing an influence of the mask a from the intermediate bit data 
masked by said masking means. 
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Claim 14. (original) A decryption apparatus for converting a ciphertext block 
into a plaintext block depending on supplied key information, comprising: 

data translation means for performing data translation to intermediate data within 
said apparatus; 

means for randomly selecting one pattern of each of pairs ai, ai (where i is a 
positive integer not less than one) of one or a plurality of predetermined mask patterns 
and mask patterns obtained by bit inversion of the predetermined mask patterns every 
time decryption is performed; 

means for masking an input to said data translation means with the mask 
patterns selected by said selection means; and 

means for removing an influence of the mask a from an output from said data 
translation means which is masked by said masking means. 

Claim 15. (original) An apparatus according to claim 12, wherein said means 
for masking the bits dependent on the plaintext within said apparatus with the selected 
mask patterns and said means for removing the influence of the mask a from the 
ciphertext comprise one of an exclusive OR, addition or subtraction with respect to a 
modulus, and multiplication or division with respect to the modulus. 

Claim 16. (original) An apparatus according to claim 13, wherein said means 
for masking the intermediate bit data within said apparatus with the selected mask 
patterns and said means for removing the influence of the mask a from the masked 
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intermediate bit data comprise one of an exclusive OR, addition or subtraction with 
respect to a modulus w, and multiplication or division with respect to the modulus w. 

Claim 17. (canceled) 

Claim 18. (original) An apparatus according to claim 14, further comprising: 
first storage means for storing, in the form of a table, said means for randomly 
selecting one pattern of each of the pairs ai, ai (where i is a positive integer not less 
than one) of one or the plurality of predetermined mask patterns and the mask patterns 
obtained by bit inversion of the predetermined mask patterns every time decryption is 
performed, said means for masking the input to said data translation means with the 
mask patterns ai, and means for removing the influence of the masks ai from the 
masked output from said data translation means; 

second storage means for storing, in the form of a table, means for masking the 

input to said data translation means with mask patterns a , and means for removing an 

influence of the masks a from the masked output from said data translation means; and 

masked data translation means for randomly selecting one of said first and 
second storage means every time decryption is performed, and performing the 
processing by said data translation means for masked data. 

Claim 19. (original) An apparatus according to claim 12, wherein the pair a, 
a of the mask patterns and the mask patterns obtained by bit inversion comprises a 
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pair a, a of predetermined fixed mask patterns and mask patterns obtained by bit 
inversion of the fixed mask patterns. 

Claim 20. (original) An apparatus according to claim 13, wherein the pair ai, 

aiof the mask patterns and the mask patterns obtained by bit inversion are not 
necessarily concealed. 
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Claim 21. (original) An apparatus according to claim 12, wherein a Hamming 
weight indicating the number of bits "1s" of an n-bit long bit sequence x is defined as 
H(x), and the Hamming weight H(a) of the mask a satisfies 0 < H(a) < n. 

Claim 22. (original) An apparatus according to claim 12, wherein a Hamming 
weight indicating the number of bits "1s" of an n-bit long bit sequence x is defined as 
H(x), and an absolute value of a difference between the Hamming weight H(a) of the 

mask a and a Hamming weight H (a) of bit inversion a of the mask a is less than n/2. 

Claim 23. (original) An encryption method of converting a plaintext block into 
a ciphertext block depending on supplied key information, comprising the steps of: 

randomly selecting one pattern of each of pairs ai, ai (where i is a positive 
integer not less than one) of one or a plurality of predetermined mask patterns and 
mask patterns obtained by bit inversion of the predetermined mask patterns every time 
encryption is performed; 
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masking bits dependent on a plaintext within the method with the selected mask 
patterns; and 

removing an influence of the mask a from a ciphertext before the ciphertext is 

output. 

Claim 24. (original) An encryption method of converting a plaintext block into 
a ciphertext block depending on supplied key information, comprising the steps of: 

randomly selecting one pattern of each of pairs ai, ai (where i is a positive 
integer not less than one) of one or a plurality of predetermined mask patterns and 
mask patterns obtained by bit inversion of the predetermined mask patterns every time 
encryption is performed; 

masking intermediate bit data within the method with the selected mask patterns; 

and 

removing an influence of the mask a from the masked intermediate bit data. 

Claim 25. (original) An encryption method of converting a plaintext block into 
a ciphertext block depending on supplied key information, comprising the steps of: 
performing data translation to intermediate data within the method; 

randomly selecting one pattern of each of pairs ai, ai (where i is a positive 
integer not less than one) of one or a plurality of predetermined mask patterns and 
mask patterns obtained by bit inversion of the predetermined mask patterns every time 
encryption is performed; 
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masking an input to the data translation step with the selected mask patterns; 



and 



removing an influence of the mask a from a masked output from the data 
translation step. 

Claim 26. (original) A method according to claim 23, wherein the step of 
masking the bits dependent on the plaintext within the method with the selected mask 
patterns and the step of removing the influence of the mask a from the ciphertext 
comprise one of an exclusive OR, addition or subtraction with respect to a modulus, and 
multiplication or division with respect to the modulus. 

Claim 27. (original) A method according to claim 24, wherein the step of 
masking the intermediate bit data within the method with the selected mask patterns 
and the step of removing the influence of the mask a from the masked intermediate bit 
data comprise one of an exclusive OR, addition or subtraction with respect to a 
modulus, and multiplication or division with respect to the modulus. 

Claim 28. (original) A method according to claim 25, wherein the data 
translation step, the step of masking the input to the data translation step with the 
selected mask patterns, and the step of removing the influence of the mask a from the 
masked output from the data translation step comprise one of an exclusive OR, addition 
or subtraction with respect to a modulus, and multiplication or division with respect to 
the modulus. 
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Claim 29. (original) A method according to claim 25, further comprising the 
steps of: 

storing, in the form of a table, the step of randomly selecting one pattern of each 
of the pairs ai, ai (where i is a positive integer not less than one) of one or the plurality 
of predetermined mask patterns and the mask patterns obtained by bit inversion of the 
predetermined mask patterns every time encryption is performed, the step of masking 
the input to said data translation step with the mask patterns ai and the step of removing 
the influence of the masks ai from the masked output from the data translation step; 

storing, in the form of a table, the step of masking the input to said data 

translation step with mask patterns a , and step of removing an influence of the masks 

a from the masked output from the data translation step; and 

randomly selecting one of the first and second storage steps every time 
encryption is performed, and performing the processing in the data translation step for 
masked data. 
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Claim 30. (original) A method according to claim 23, wherein the pair ai, aiof 
the mask patterns and the mask patterns obtained by bit inversion comprises a pair a, 

a of predetermined fixed mask patterns and mask patterns obtained by bit inversion of 
the fixed mask patterns. 

Claim 31 . (original) A method according to claim 23, wherein that the pair a, 

a of the mask patterns and the mask patterns obtained by bit inversion are not 
necessarily concealed. 
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Claim 32. (original) A method according to claim 23, wherein a Hamming 
weight indicating the number of bits "1" of an n-bit long bit sequence x is defined as 
H(x), and the Hamming weight H(a) of the mask a satisfies 0 < H(a) < n. 



Claim 33. (original) A method according to claim 23, wherein a Hamming 
weight indicating the number of bits "1s" of an n-bit long bit sequence x is defined as 
H(x), and an absolute value of a difference between the Hamming weight H(a) of the 
mask a and a Hamming weight H (a) of bit inversion a of the mask a is less than n/2. 
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Claim 34. (original) A decryption method of converting a ciphertext block into 
a plaintext block depending on supplied key information, comprising the steps of: 

randomly selecting one pattern of each of pairs ai, ai (where i is a positive 
integer not less than one) of one or a plurality of predetermined mask patterns and 
mask patterns obtained by bit inversion of the predetermined mask patterns every time 
decryption is performed; 

masking bits dependent on a ciphertext within the method with the selected mask 
patterns; and 

removing an influence of the mask a from a plaintext before the plaintext is 

output. 

Claim 35. (original) A decryption method of converting a ciphertext block into 
a plaintext block depending on supplied key information, comprising the steps of: 
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randomly selecting one pattern of each of pairs ai, ai (where } is a positive 
integer not less than one) of one or a plurality of predetermined mask patterns and 
mask patterns obtained by bit inversion of the predetermined mask patterns every time 
decryption is performed; 

masking intermediate bit data within the method with the selected mask patterns; 

and 

removing an influence of the mask a from the masked intermediate bit data. 

Claim 36. (original) A decryption method of converting a ciphertext block into 
a plaintext block depending on supplied key information, comprising the steps of: 
performing data translation to intermediate data within the method; 

randomly selecting one pattern of each of pairs ai, ai (where i is a positive 
integer not less than one) of one or a plurality of predetermined mask patterns and 
mask patterns obtained by bit inversion of the predetermined mask patterns every time 
decryption is performed; 

masking an input to the data translation step with the selected mask patterns; 

and 

removing an influence of the mask a from a masked output from the data 
translation step. 

Claim 37. (original) A method according to claim 34, wherein that the step of 
masking the bits dependent on the ciphertext within the method with the selected mask 
patterns and the step of removing the influence of the mask a from the plaintext 
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comprise one of an exclusive OR, addition or subtraction with respect to a modulus w, 
and multiplication or division with respect to the modulus w. 



Claim 38. (original) A method according to claim 35, wherein the step of 
masking the intermediate bit data within the method with the selected mask patterns 
and the step of removing the influence of the mask a from the masked intermediate bit 
data comprise one of an exclusive OR, addition or subtraction with respect to a 
modulus, and multiplication or division with respect to the modulus. 
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Claim 39. (original) A method according to claim 36, wherein the data 
translation step, the step of masking the input to the data translation step with the 
selected mask patterns, and the step of removing the influence of the mask a from the 
masked output from the data translation step comprise one of an exclusive OR, addition 
or subtraction with respect to a modulus, and multiplication or division with respect to 
the modulus. 

Claim 40. (original) A method according to claim 36, further comprising the 
steps of: 

storing, in the form of a table, the step of randomly selecting one pattern of each 

of the pairs ai, ai (where i is a positive integer not less than one) of one or the plurality 
of predetermined mask patterns and the mask patterns obtained by bit inversion of the 
predetermined mask patterns every time decryption is performed, the step of masking 
the input to said data translation step with the mask patterns ai, and the step of 
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removing the influence of the masks ai from the masked output from the data translation 
step; 

storing, in the form of a table, the step of masking the input to said data 

translation step with mask patterns a , and step of removing an influence of the masks 

a from the masked output from the data translation step; and 

randomly selecting one of the first and second storage steps every time 
decryption is performed, and performing the processing in the data translation step for 
masked data. 

Claim 41. (original) A method according to claim 34, wherein the pair a, a of 
the mask patterns and the mask patterns obtained by bit inversion comprises a pair a, 

a of predetermined fixed mask patterns and mask patterns obtained by bit inversion of 
the fixed mask patterns. 

Claim 42. (original) A method according to claim 34, wherein the pair a, a of 
the mask patterns and the mask patterns obtained by bit inversion are not necessarily 
concealed. 

Claim 43. (previously amended) A method according to claim 34, wherein a 
Hamming weight indicating the number of "1" bits of an n-bit long bit sequence x is 
defined as H(x), and the Hamming weight H(a) of the mask a satisfies 0 < H(a) < n. 
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Claim 44. (previously amended) A method according to claim 34, wherein a 
Hamming weight indicating the number of "1" bits of an n-bit long bit sequence x is 
defined as H(x), and an absolute value of a difference between the Hamming weight 

H(a) of the mask a and a Hamming weight H (a) of bit inversion a of the mask a is less 

than n/2. 
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Claim 45. (original) A computer-usable program storage medium storing 
computer-readable program code means for converting a plaintext block into a 
ciphertext block depending on supplied key information, comprising: 

computer-readable program code means for causing a computer to randomly 

select one pattern of each of pairs ai, ai (where i is a positive integer not less than one) 
of one or a plurality of predetermined mask patterns and mask patterns obtained by bit 
inversion of the predetermined mask patterns every time encryption is performed; 

computer-readable program code means for causing said computer to mask bits 
dependent on a plaintext within the method with the selected mask patterns; and 

computer-readable program code means for causing said computer to remove an 
influence of the mask a from a ciphertext before the ciphertext is output. 

Claim 46. (original) An encryption apparatus for converting a plaintext block 
into a ciphertext block depending on supplied key information, comprising: 

means for randomly selecting one pattern of each of pairs ai, ai (where i is a 
positive integer not less than one) of one or a plurality of predetermined mask patterns 
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and mask patterns obtained by bit inversion of the predetermined mask patterns every 
time encryption is performed; 

means for masking bits dependent on a key within said apparatus with the mask 
patterns selected by said selection means; 

data translation means for converting intermediate data within said apparatus 
with the key; and 

means for removing an influence of the mask a from an output from said data 
translation means. 

Claim 47. (original) An apparatus according to claim 46, wherein the pair a, 

a of the mask patterns and the mask patterns obtained by bit inversion comprises a 

pair a, a of predetermined fixed mask patterns and mask patterns obtained by bit 
inversion of the fixed mask patterns. 

Claim 48. (original) An apparatus according to claim 46, wherein the pair a, 

a of the mask patterns and the mask patterns obtained by bit inversion are not 
necessarily concealed. 

Claim 49. (original) An apparatus according to claim 46, wherein a Hamming 
weight indicating the number of bits "1s" of an n-bit long bit sequence x is defined as 
H(x), and the Hamming weight H(a) of the mask -a satisfies 0 < H(a) < n. 
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Claim 50. (original) An apparatus according to claim 46, wherein a Hamming 
weight indicating the number of bits "1s" of an n-bit long bit sequence x is defined as 
H(x), and an absolute value of a difference between the Hamming weight H(a) of the 



mask a and a Hamming weight H (a) of bit inversion a of the mask a is less than n/2. 



Claim 51. (canceled). 
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